Executive brief
The Date::Manip Perl library, used for parsing and manipulating dates, contains a flaw where it incorrectly processes certain non-standard numeric characters (Unicode digits). An attacker can provide a date string containing these characters to cause the library to return a "corrupted" date that is different from what was intended, without triggering an error. This could lead to logic errors in applications that rely on the library for critical functions like checking expiration dates or data retention windows.
Technical details
The vulnerability exists because Date::Manip uses the `\d` regex shorthand to capture year, month, and day fields. In Perl, `\d` matches the Unicode `\p{Nd}` property, allowing non-ASCII digits (e.g., Arabic-Indic digits) to be captured. While the library performs numeric range checks (e.g., `$m < 1 || $m > 12`), it later numifies these fields using `$field + 0`. Perl's numification truncates strings at the first non-ASCII digit. Consequently, a field like "202" followed by a Unicode digit will pass range checks as "202" but result in an incorrect date value (e.g., year 0202) without a parsing error. This can bypass logic in calling applications that use parsed dates for security-sensitive comparisons. Patching information is available via CPANSec.
Affected products
- SBECK (CPAN) Date::Manip through 6.99
Timeline
- 2026-07-30: disclosed
- 2026-07-30: advisory